Miniflux 2.2.19

Release date: April 4, 2026

Changes

Remove sensitive values (CSRF tokens, OAuth state, session cookies) from log messages.
Improve OAuth2 security:
- Verify OIDC ID token signatures and claims.
- Prevent OAuth identity overwrite when already linked.
- Clear PKCE verifier and CSRF state after use.
- Validate HTTP status from Google userinfo endpoint.
Use HMAC-SHA256 instead of SHA1 for Google Reader API authentication.
Use constant-time comparison for token validation.
Fix potential DoS when truncating large untrusted input in templates.
Reject oversized favicons.

Improve configuration validation with cross-field consistency checks.
OAuth2:
- Explicit provider selection via OAUTH2_PROVIDER.
- Better separation between Google and OIDC providers.
- Updated Google OAuth endpoints to v2.
UI:
- Add cache-busting for static assets (JS, CSS, icons).
- Add Cache-Control: immutable for static resources.
Sanitizer:
- Allow iframes from framatube.org.
- Improve performance and parsing behavior.
Metrics and workers:
- Graceful shutdown support for worker pool and metrics collector.
- Better error reporting for metrics.
API / HTTP:
- Support weak ETag comparison.
- Improve response helpers and headers handling.

Reduce number of SQL queries for unread entries and UI pages.
Optimize database queries and locking behavior:
- Use SKIP LOCKED in archive operations.
- Reduce unnecessary queries and connections.
Improve UI performance:
- Cache keymaps instead of recomputing on each keypress.
- Batch DOM updates when marking entries as read.
Optimize sanitizer, media proxy, routing, and template rendering.
Reduce allocations in various hot paths.

Remove dependency on gorilla/mux across the codebase.
Improve code structure and naming consistency (API, OAuth2, config, validators).
Simplify timezone and server setup logic.
Improve testability and documentation (GoDoc updates).

As always, thank you to all contributors who helped improve Miniflux in this release.